State Estimation Attack

Cross-validate state estimates by fusing independent, heterogeneous sensor modalities. An attack on a single LiDAR unit becomes detectable when the Inertial Measurement Unit (IMU) and odometry data predict a contradictory trajectory. Implement majority voting or Mahalanobis distance gating to isolate and discard corrupted sensor streams before they update the belief state.

• Deploy triple modular redundancy for critical proprioceptive sensors
• Use extended Kalman filters with innovation sequence monitoring
• Cross-check camera-based odometry against wheel encoders

Continuously monitor the normalized innovation squared (NIS) of the Kalman filter. A state estimation attack introduces a statistically anomalous discrepancy between the predicted measurement and the actual sensor reading. When the chi-squared test statistic exceeds a critical threshold, the system flags the measurement as adversarial and falls back to dead reckoning.

• Tune the detection threshold based on desired false positive rate
• Combine with cumulative sum (CUSUM) for detecting subtle, gradual attacks
• Trigger a sensor reset or re-initialization upon persistent alarms

Apply robust filtering techniques that are inherently resilient to outlier measurements. Replace standard Gaussian assumptions with heavy-tailed distributions like the Student's t-distribution or implement an M-estimator within the update step. This prevents a single corrupted GPS or LiDAR reading from catastrophically pulling the state estimate.

• Use Huber loss to bound the influence of large residuals
• Implement a particle filter with an adaptive number of particles
• Deploy a switching Kalman filter that models both nominal and attacked dynamics

Actively probe the environment to verify sensor integrity. An autonomous vehicle can emit a known, modulated LiDAR pulse pattern and verify that the received reflection matches the expected time-of-flight and signal encoding. Any injected phantom object will fail this cryptographic challenge, revealing the spoofing attack.

• Embed pseudo-random binary sequences in transmitted signals
• Cross-validate with radar using orthogonal waveforms
• Implement frequency hopping to avoid predictable jamming windows

Provide formal guarantees on the maximum deviation of the state estimate under bounded sensor attacks. Techniques like set-membership estimation or zonotope-based reachability analysis compute an over-approximated set of all possible states consistent with the corrupted measurements. The agent's planner can then select actions that are safe for every state within the guaranteed bound.

• Use interval analysis for computationally lightweight bounding
• Integrate with a shield in the control loop to veto unsafe actions
• Apply randomized smoothing to the perception-to-state mapping

Exploit the physical continuity of the real world. A state estimation attack that injects a phantom obstacle or teleports the agent's position creates a physically implausible discontinuity in the trajectory. Monitor the jerk and snap derivatives of the estimated state; any violation of the vehicle's dynamic constraints triggers an alert.

• Enforce non-holonomic constraints on the state transition
• Compare the estimated velocity against the actuator command history
• Use a long short-term memory (LSTM) autoencoder trained on nominal trajectories to detect anomalous sequences